Security audit

mailbox.bot

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real mailbox.bot integration, but it needs review because it can send, read, and permanently dispose of physical mail with some automatic-rule examples that are not tightly guarded.

Review before installing. Use sandbox or dry_run first, prefer agent-scoped test keys, enable force_approval or requires_approval for real sends, set cost caps, and do not allow automatic shred/dispose/discard rules unless the sender/category is tightly defined and a human has approved the policy.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README promotes workflows that can send real-world physical mail and process inbound scans, photos, OCR output, and other potentially sensitive documents, but it does not prominently warn operators about privacy risks, legal/compliance obligations, or the irreversible real-world effects of agent-triggered actions. In an agent-integrated context, this omission increases the chance of unsafe automation, accidental disclosure of personal data, or unintended mail being sent without adequate human review.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill advertises irreversible mail actions such as shred, dispose, and return-to-sender without clearly warning that these can permanently destroy originals or interrupt legal/compliance workflows. In a tool explicitly meant to process legal, tax, and business correspondence, omission of safeguards materially increases the chance an agent or operator will trigger destructive actions prematurely.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The MAILBOX.md example includes an automatic 'Junk mail → discard' rule with no caution that misclassification can cause permanent mail loss. Because the skill encourages autonomous standing instructions, an agent could discard important but mislabeled mail such as legal notices, invoices, or compliance documents without human review.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The API action list exposes destructive operations directly and presents them alongside non-destructive actions without emphasizing irreversible consequences. This normalizes dangerous actions in a way that can lead integrators or autonomous agents to invoke them without adequate preconditions, review, or retention checks.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The decision framework instructs agents to discard junk mail as part of triage without warning about classification errors or downstream legal/data-loss consequences. In the context of business and legal mail handling, this creates a realistic risk of permanent destruction of important correspondence by autonomous or semi-autonomous workflows.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide advertises capabilities to send real physical mail and access inbound document context, but it does not prominently warn that these actions may transmit sensitive data to a third-party service or trigger irreversible real-world effects. In an AI-agent installation context, omission of privacy and side-effect disclosures increases the chance that users or agents enable powerful tools without informed consent or appropriate safeguards.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The manifest advertises capabilities to send physical mail, retrieve source documents, and use inbound address context, but it does not surface any warning about transmitting sensitive data to a third-party service or causing real-world postal actions. In an agent setting, this omission increases the chance that users or downstream orchestrators invoke the skill without understanding privacy, compliance, cost, or irreversible delivery consequences.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:85